The Week in Review from Stamus Labs

Welcome to the weekly threat detection update report from Stamus Networks. Each week, you will receive this email with a summary of the updates.

 

Current Stamus Threat Intelligence (STI) release version: 397

This week, in addition to daily ruleset and IOC updates, we provided Stamus Security Platform customers with the following improved defense(s):

• New threat detection(s) added [1]: 6 (BlackGuard, B1txor20, DeviousDrone, Blackmoon, SharkBot, Realrat)
• Major changes to detections(s) [2]: 39
• Updated threat detection(s) [3]: 75

 

Note: a "method" as referenced below, is a discrete detection vector for a given threat.

 

New Threat(s) Detected

The following detections were added to your Stamus NDR this past week:

 

BlackGuard (Data Theft)

The term info stealer is self-explanatory. This type of malware resides in an infected computer and gathers data in order to send it to the attacker. Typical targets are credentials used in online banking services, social media sites, emails, or FTP accounts.

Info stealers may use many methods of data acquisition. The most common are:

hooking browsers (and sometimes other applications) and stealing credentials that are typed by the user using web injection scripts that are adding extra fields to web forms and submitting information from them to a server owned by the attacker form grabbing (finding specific opened windows and stealing their content) keylogging stealing passwords saved in the system and cookies Modern info stealers are usually parts of botnets. Sometimes the target of attack and related events are configured remotely by the command sent from the Command and Control server (C&C). Malwarebytes

BlackGuard - MITRE - Multi-Stage Channels | BlackGuard - MITRE - Data Encoding | BlackGuard - MITRE - Malicious File | BlackGuard - MITRE - User Execution |

 

Total number of detection methods: 3
Kill chain phase(s): actions on objectives, command and control

 

B1txor20 (Backdoor)

In the world of cybersecurity, a backdoor refers to any method by which authorized and unauthorized users are able to get around normal security measures and gain high level user access (aka root access) on a computer system, network, or software application. Once they're in, cybercriminals can use a backdoor to steal personal and financial data, install additional malware, and hijack devices. [Malwarebytes] (https://www.malwarebytes.com/backdoor/)

B1txor20 - netlab360 | B1txor20 - MITRE - Protocol Tunneling | B1txor20 - MITRE - Ingress Tool Transfer |

 

Total number of detection methods: 5
Kill chain phase(s): command and control

 

DeviousDrone (Trojan)

 

A Trojan horse or Trojan is a type of malware that is often disguised as legitimate software. Trojans can be employed by cyber-thieves and hackers trying to gain access to users' systems. Users are typically tricked by some form of social engineering into loading and executing Trojans on their systems. Once activated, Trojans can enable cyber-criminals to spy on you, steal your sensitive data, and gain backdoor access to your system. Kaspersky

 

 

DeviousDrone - MITRE - Abuse Elevation Control Mechanism | DeviousDrone - MITRE - Multi-Stage Channels | DeviousDrone - MITRE - Ingress Tool Transfer |

 

Total number of detection methods: 8
Kill chain phase(s): command and control

 

Blackmoon (Data Theft)

 

First analyzed in early 2014 [1] [2], the Blackmoon banking Trojan targets a user’s online banking credentials using a type of pharming that involves modifying or replacing the local Hosts file with one that redirects online banking domain lookups to an IP address controlled by the attacker. Blackmoon has been observed targeting primarily customers of South Korean online banking sites and services, and is usually distributed via drive-by download. Proofpoint

Blackmoon - malpedia | Blackmoon - microsoft | Blackmoon - MITRE - Data Encoding | Blackmoon - MITRE - Command and Scripting Interpreter | Blackmoon - MITRE - Ingress Tool Transfer | Blackmoon - MITRE - Ingress Tool Transfer | Blackmoon - MITRE - System Information Discovery |

 

Total number of detection methods: 21
Kill chain phase(s): command and control, delivery
MITRE ATT&CK: T1566

 

SharkBot (Data Theft)

SharkBot is a piece of malicious software targeting Android Operating Systems (OSes). It is designed to obtain and misuse financial data by redirecting and stealthily initiating money transfers. SharkBot is particularly active in Europe (United Kingdom, Italy, etc.), but its activity has also been detected in the United States. Pcrisk

SharkBot - malpedia | SharkBot - microsoft | SharkBot - MITRE - Capture SMS Messages | SharkBot - MITRE - Screen Capture | SharkBot - MITRE - Input Capture | SharkBot - MITRE - Exfiltration Over C2 Channel |

 

Total number of detection methods: 2
Kill chain phase(s): command and control
MITRE ATT&CK: T1041

 

Realrat (RAT)

Remote Access Trojans are programs that provide the capability to allow covert surveillance or the ability to gain unauthorized access to a victim PC. Remote Access Trojans often mimic similar behaviors of keylogger applications by allowing the automated collection of keystrokes, usernames, passwords, screenshots, browser history, emails, chat lots, etc. Remote Access Trojans differ from keyloggers in that they provide the capability for an attacker to gain unauthorized remote access to the victim machine via specially configured communication protocols which are set up upon initial infection of the victim computer. This backdoor into the victim machine can allow an attacker unfettered access, including the ability to monitor user behavior, change computer settings, browse and copy files, utilize the bandwidth (Internet connection) for possible criminal activity, access connected systems, and more. Malwarebytes

Realrat - MITRE - Exfiltration Over C2 Channel | Realrat - MITRE - Multi-Stage Channels | Realrat - MITRE - Ingress Tool Transfer | Realrat - MITRE - System Information Discovery | Realrat - MITRE - File and Directory Discovery | Realrat - MITRE - Malicious File |

 

Total number of detection methods: 30
Kill chain phase(s): command and control

 

Major Detection Changes

The following detections were updated this past week with changes to kill chain phase(s) or MITRE ATT&CK tactic(s)/technique(s):

 

APT 29 (APT)

APT29 is threat group that has been attributed to the Russian government and has operated since at least 2008. This group reportedly compromised the Democratic National Committee starting in the summer of 2015. MITRE

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): actions on objectives, command and control
Methods added: 2

 

APT38 (APT)

APT38 is a financially-motivated threat group that is backed by the North Korean regime. The group mainly targets banks and financial institutions and has targeted more than 16 organizations in at least 13 countries since at least 2014.

North Korean group definitions are known to have significant overlap, and the name Lazarus Group is known to encompass a broad range of activity. Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea. Some organizations track North Korean clusters or groups such as Bluenoroff, APT37, and APT38 separately, while other organizations may track some activity associated with those group names by the name Lazarus Group. MITRE

Added kill chain phase(s): delivery
Previously supported kill chain phase(s): command and control, delivery
Methods added: 1

 

Cobalt Strike (Pentest Tools)

Cobalt Strike is a commercial, full-featured, penetration testing tool which bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.

In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz. MITRE

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, actions on objectives, exploitation, delivery
MITRE ATT&CK added: T1001
Previously existing MITRE ATT&CK: T1041, T1587, T1001, T1573
Methods added: 6

 

Delf (Data Theft)

Delf is a large family of malicious programs, many of which are associated with data theft. F-secure

Added kill chain phase(s): actions on objectives
Previously supported kill chain phase(s): installation, command and control, delivery, actions on objectives
Methods added: 1

 

FIN7 (APT)

FIN7 is a financially-motivated threat group that has primarily targeted the U.S. retail, restaurant, and hospitality sectors since mid-2015. They often use point-of-sale malware. A portion of FIN7 was run out of a front company called Combi Security. FIN7 is sometimes referred to as Carbanak Group, but these appear to be two groups using the same Carbanak malware and are therefore tracked separately. MITRE

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, actions on objectives, delivery
Methods added: 3

 

Gamaredon (APT)

Gamaredon Group is a threat group that has been active since at least 2013 and has targeted individuals likely involved in the Ukrainian government. The name Gamaredon Group comes from a misspelling of the word "Armageddon", which was detected in the adversary's early campaigns. MITRE

Added kill chain phase(s): delivery
Previously supported kill chain phase(s): actions on objectives, command and control, delivery
Methods added: 1

 

Kimsuky (APT)

Kimsuky is a North Korean-based threat group that has been active since at least September 2013. The group initially focused on targeting Korean think tanks and DPRK/nuclear-related targets, expanding recently to the United States, Russia, and Europe. The group was attributed as the actor behind the Korea Hydro & Nuclear Power Co. compromise. MITRE

Added kill chain phase(s): actions on objectives
Previously supported kill chain phase(s): command and control, actions on objectives, delivery
Methods added: 2

 

Pterodo (Backdoor)

In the world of cybersecurity, a backdoor refers to any method by which authorized and unauthorized users are able to get around normal security measures and gain high level user access (aka root access) on a computer system, network, or software application. Once they're in, cybercriminals can use a backdoor to steal personal and financial data, install additional malware, and hijack devices. [Malwarebytes] (https://www.malwarebytes.com/backdoor/)

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control
Methods added: 1

 

Remcos (RAT)

Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security.

Remcos has been observed being used in malware campaigns.

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, delivery
Methods added: 1

 

Scarab (Ransomware)

Discovered by malware security researcher, Michael Gillespie, Scarab is a ransomware-type virus that stealthily infiltrates systems and encrypts various data. During encryption, Scarab appends filenames with the ".[resque@plague.desi].scarab" extension. Pcrisk

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control
Methods added: 1

 

Sidecopy (APT)

The SideCopy APT is a Pakistani threat actor that has been operating since at least 2019, mainly targeting South Asian countries and more specifically India and Afghanistan. Its name comes from its infection chain that tries to mimic that of the SideWinder APT. It has been reported that this actor has similarities with Transparent Tribe (APT36) and possibly is a subdivision of this actor. Cisco Talos and Seqrite have provided comprehensive reports on this actor’s activities. Malwarebytes

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control
Methods added: 2

 

Stealer and Exfiltration (Data Theft)

The term info stealer is self-explanatory. This type of malware resides in an infected computer and gathers data in order to send it to the attacker. Typical targets are credentials used in online banking services, social media sites, emails, or FTP accounts.

Info stealers may use many methods of data acquisition. The most common are:

hooking browsers (and sometimes other applications) and stealing credentials that are typed by the user using web injection scripts that are adding extra fields to web forms and submitting information from them to a server owned by the attacker form grabbing (finding specific opened windows and stealing their content) keylogging stealing passwords saved in the system and cookies Modern info stealers are usually parts of botnets. Sometimes the target of attack and related events are configured remotely by the command sent from the Command and Control server (C&C). Malwarebytes

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): actions on objectives, command and control, exploitation, delivery
Methods added: 2

 

StrongPity (Data Theft)

StrongPity is an information stealing malware used by PROMETHIUM. MITRE

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, delivery
Methods added: 2

 

TA445 (APT)

Proofpoint researchers have identified a phishing campaign originating from an email address (ukr[.]net) that appears to belong to a compromised Ukranian armed service member. This discovery comes on the heels of alerts by the Ukrainian Computer Emergency Response Team (CERT-UA) and the State Service of Special Communications and Information Protection of Ukraine about widespread phishing campaigns targeting private email accounts of Ukrainian armed service members by ‘UNC1151’, which Proofpoint tracks as part of TA445. The email observed by Proofpoint may represent the next stage of these attacks. The email included a malicious macro attachment which utilised social engineering themes pertaining to the Emergency Meeting of the NATO Security Council held on February 23, 2022. The email also contained a malicious attachment which attempted to download malicious Lua malware named SunSeed and targeted European government personnel tasked with managing transportation and population movement in Europe. While Proofpoint has not definitively attributed this campaign to the threat actor TA445, researchers acknowledge that the timeline, use of compromised sender addresses aligning with Ukrainian government reports, and the victimology of the campaign align with published TA445 tactics to include the targeting and collection around refugee movement in Europe. Proofpoint

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): delivery, command and control
Methods added: 2

 

Trojan Agent (Trojan)

Again, the generic nature of this detection means that the Payloads performed by this group of trojans may be highly variable, and therefore difficult to describe specifically. This group of trojans has been observed to perform any, or all, of the following actions:
redirect Web traffic
- manipulate certain Windows or third-party applications including settings or configurations
- drop or install additional malicious programs
- download and run additional malicious programs
Please note that this list is not exhaustive.
Microsoft

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, actions on objectives, delivery, installation
Methods added: 1

 

Trojan Downloader (Downloader)

A Trojan downloader is a type of Trojan horse that downloads and installs files, often malicious programs. A Trojan horse is a type of software that looks legitimate but can be malicious in nature. Sometimes these programs can be downloaded onto a device without the user’s knowledge or consent. A Trojan’s purpose is to damage, disrupt, steal, or generally inflict some other harm on your computer and devices. Norton

Added kill chain phase(s): command and control, delivery
Previously supported kill chain phase(s): delivery, command and control, actions on objectives
Methods added: 6

 

Trojan Dropper (Trojan)

A dropper is a kind of Trojan that has been designed to "install" some sort of malware (virus, backdoor, etc.) to a target system. The malware code can be contained within the dropper (single-stage) in such a way as to avoid detection by virus scanners or the dropper may download the malware to the target machine once activated (two stage). Wikipedia

Added kill chain phase(s): command and control, delivery
Previously supported kill chain phase(s): command and control, delivery, installation, actions on objectives
Methods added: 3

 

TrojanSpy-Android (Data Theft)

Malicious programs of this family secretly send information to the criminal from the user’s infected Android mobile device. Kaspersky

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, actions on objectives, delivery
Methods added: 2

 

Other Threat Detection Update(s)

The following threat detection(s) were improved this past week with new or updated threat methods.

 

Name of threat	New coverage			Total coverage			Last updated
	New Detection methods	Kill chain phases	Protocols involved	Detection methods	Kill chain phases	Protocols involved
APT 29	2	command and control	dns	92	actions on objectives, command and control	dns, ftp, http, tls	2022-03-25
APT38	1	delivery	http	79	command and control, delivery	dns, http, tcp, tls	2022-03-22
B1txor20	5	command and control	dns	5	command and control	dns	2022-03-23
BlackGuard	1	command and control	http	3	command and control	http	2022-03-23
Blackmoon	21	command and control, delivery	http, tcp-pkt	21	command and control, delivery	http, tcp-pkt	2022-03-23
Cobalt Strike	6	command and control	tls, http, dns	338	actions on objectives, command and control, delivery, exploitation	dns, http, smb, tcp, tls, udp	2022-03-25
Delf	1	actions on objectives	http	90	actions on objectives, command and control, delivery, installation	http, smtp, tcp, tls	2022-03-25
DeviousDrone	8	command and control	dns	8	command and control	dns	2022-03-23
FIN7	3	command and control	http, dns	78	actions on objectives, command and control, delivery	dns, http, tcp, tls	2022-03-26
Gamaredon	1	delivery	http	84	actions on objectives, command and control, delivery	dns, http	2022-03-23
Kimsuky	2	actions on objectives	http	85	actions on objectives, command and control, delivery	dns, ftp, http, tls	2022-03-26
Pterodo	1	command and control	http	25	command and control	http	2022-03-23
Remcos	1	command and control	tcp	802	command and control, delivery	dns, http, tcp	2022-03-23
Scarab	1	command and control	dns	2	command and control	dns, http	2022-03-23
SharkBot	1	command and control	dns	2	command and control	dns	2022-03-23
Sidecopy	2	command and control	http, dns	10	command and control	dns, http	2022-03-23
Stealer and Exfiltration	2	command and control	dns, http	194	actions on objectives, command and control, delivery, exploitation	dns, ftp, http, smtp, tcp, tls	2022-03-24
StrongPity	2	command and control	http, dns	95	command and control, delivery	dns, http, tls	2022-03-22
TA445	2	command and control	dns	6	command and control, delivery	dns, http	2022-03-23
Trojan Agent	1	command and control	http	322	actions on objectives, command and control, delivery, installation	dns, http, ip, smtp, tcp, tcp-pkt, tcp-stream, udp	2022-03-22
Trojan Downloader	6	command and control, delivery	http, dns	187	actions on objectives, command and control, delivery	dns, http, tcp, tls, udp	2022-03-26
Trojan Dropper	3	command and control, delivery	dns, tls, http	226	actions on objectives, command and control, delivery, installation	dns, http, tcp, tls, udp	2022-03-24
TrojanSpy-Android	2	command and control	dns, tls	331	actions on objectives, command and control, delivery	dns, http, tcp, tls	2022-03-24

 

Additional Resources

Technical support
Join the conversation on Discord
Follow us Twitter
Follow us on LinkedIn
Subscribe to our YouTube channel
Stamus Networks website